vulnerability-scanning
vulnerability-scanning is an code AI skill with a core value of Scan systems and dependencies for CVEs and security vulnerabilities. It
helps developers solve real-world problems in the code domain, boosting
efficiency, automating repetitive tasks, and optimizing workflows.
Scan systems and dependencies for CVEs and security vulnerabilities.
Quick Facts
mkdir -p ./skills/vulnerability-scanning && curl -sfL https://raw.githubusercontent.com/sickn33/antigravity-awesome-skills/main/skills/vulnerability-scanning/SKILL.md -o ./skills/vulnerability-scanning/SKILL.md Run in terminal / PowerShell. Requires curl (Unix) or PowerShell 5+ (Windows).
Skill Content
> **⚠️ AUTHORIZED USE ONLY**
> This skill is for educational purposes or authorized security assessments only.
> You must have explicit, written permission from the system owner before using this tool.
> Misuse of this tool is illegal and strictly prohibited.
> **Mandatory confirmation gate**
> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
> 1. Ask the user to state the exact target URL, IP, account, or resource.
> 2. Ask the user to confirm written authorization and the permitted scope.
> 3. Show the exact command(s) and explain their expected effect.
> 4. Wait for explicit confirmation in the current conversation.
>
> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
# Vulnerability Scanning
Identify and prioritize security vulnerabilities across infrastructure and applications.
When to Use This Skill
Use this skill when:
- Performing security assessments
- Implementing vulnerability management programs
- Meeting compliance requirements
- Triaging and prioritizing remediation
- Scanning infrastructure for known CVEs
Prerequisites
- Access to scanning tools
- Network access to targets
- Appropriate authorization
Vulnerability Scanning Tools
| Tool | Type | Best For |
|------|------|----------|
| Nessus | Commercial | Enterprise scanning |
| OpenVAS | Open Source | Free alternative |
| Qualys | Cloud SaaS | Large scale |
| Nexpose/InsightVM | Commercial | Asset management |
| Nuclei | Open Source | Template-based |
OpenVAS Setup
Docker Deployment
# Run OpenVAS container
docker run -d --name openvas \
-p 443:443 \
-v openvas-data:/data \
greenbone/openvas-scanner
# Access web UI at https://localhost
# Default credentials: admin/adminScanning Commands
# Create target
omp -u admin -w admin --xml='<create_target>
<name>Web Servers</name>
<hosts>192.168.1.0/24</hosts>
</create_target>'
# Create task
omp -u admin -w admin --xml='<create_task>
<name>Weekly Scan</name>
<target id="target-uuid"/>
<config id="daba56c8-73ec-11df-a475-002264764cea"/>
</create_task>'
# Start task
omp -u admin -w admin --xml='<start_task task_id="task-uuid"/>'
# Get results
omp -u admin -w admin --xml='<get_results task_id="task-uuid"/>'Nessus
API Usage
import requests
class NessusScanner:
def __init__(self, url, access_key, secret_key):
self.url = url
self.headers = {
'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}',
'Content-Type': 'application/json'
}
def create_scan(self, name, targets, template='basic'):
"""Create a new scan."""
templates = self.get('/editor/scan/templates')
template_uuid = next(
t['uuid'] for t in templates['templates']
if t['name'] == template
)
payload = {
'uuid': template_uuid,
'settings': {
'name': name,
'text_targets': targets,
'enabled': True
}
}
return self.post('/scans', payload)
def launch_scan(self, scan_id):
"""Start a scan."""
return self.post(f'/scans/{scan_id}/launch')
def get_results(self, scan_id):
"""Get scan results."""
return self.get(f'/scans/{scan_id}')
def export_report(self, scan_id, format='pdf'):
"""Export scan report."""
payload = {'format': format}
response = self.post(f'/scans/{scan_id}/export', payload)
file_id = response['file']
# Wait for export
while True:
status = self.get(f'/scans/{scan_id}/export/{file_id}/status')
if status['status'] == 'ready':
break
time.sleep(5)
return self.get(f'/scans/{scan_id}/e🎯 Best For
- Security auditors
- DevSecOps teams
- Compliance officers
- Claude users
- Software engineers
💡 Use Cases
- Auditing dependencies for known CVEs
- Scanning API endpoints for auth gaps
- Code quality improvement
- Best practice enforcement
📖 How to Use This Skill
- 1
Install the Skill
Copy the install command from the Terminal tab and run it. The SKILL.md file downloads to your local skills directory.
- 2
Load into Your AI Assistant
Open Claude and reference the skill. Paste the SKILL.md content or use the system prompt tab.
- 3
Apply vulnerability-scanning to Your Work
Open your project in the AI assistant and ask it to apply the skill. Start with a small module to verify the output quality.
- 4
Review and Refine
Review AI suggestions before committing. Run tests, check for regressions, and iterate on the skill output.
❓ Frequently Asked Questions
Can this replace a dedicated SAST tool?
AI-based security review is complementary to SAST tools. Use it as a first-pass filter, not a replacement.
Is vulnerability-scanning compatible with Cursor and VS Code?
Yes — this skill works with any AI coding assistant including Cursor, VS Code with Copilot, and JetBrains IDEs.
Do I need specific dependencies for vulnerability-scanning?
Check the install command and Works With section. Most code skills only require the AI assistant and your codebase.
How do I install vulnerability-scanning?
Copy the install command from the Terminal tab and run it. The skill downloads to ./skills/vulnerability-scanning/SKILL.md, ready to use.
Can I customize this skill for my team?
Absolutely. Edit the SKILL.md file to add team-specific instructions, examples, or workflows.
⚠️ Common Mistakes to Avoid
Only scanning surface-level issues
Deep security review requires understanding your app architecture, not just regex patterns.
Skipping validation
Always test AI-generated code changes, even for simple refactors.
Missing dependency updates
Check if the skill requires updated dependencies or new packages.